Intrusion Detection Method Based on Support Vector Machine Access of Modbus TCP Protocol
Abstract
As the mix of industrial automation control system and the Internet, the industrial control system is becoming more and more vulnerable. The key of information security is how to detect and resist attacks on industrial control systems. This paper proposes a data preprocessing method, this method can convert ModbusTCP traffic into another data that the support vector machine model can identify. This method is based on the frequency of Modbus protocol function code and coil appear in ModbusTCP traffic to detect the abnormal Modbus TCP traffic.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Simulation environments and tools have provided methods for analyzing threats such as stealthy attack, Heuristic Inference Attacks, related system vulnerabilities, and exploring protections such as Blockchain and AI algorithms for intrusion detection systems.
“These simulation environments and tools have provided methods for analyzing various types of threats such as stealthy attack [180], or new family attacks such as Heuristic Inference Attacks [181], related system vulnerabilities as well as exploring new ways to protect critical infrastructures such as Blockchain [182] and implementation of AI algorithms for intrusion detection systems (IDS) such as”
From SCADA Systems With Focus on Continuous Manufacturing and Steel Industry: A Survey on Architectures, Standards, Challenges and Industry 5.0 (2022) · cites this paper as [182]
Cites
LIBSVM: A library for support vector machines
Chang, C.-C., & Lin, C.-J. (2011) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/1961189.1961199 · Cited by 40,918 · see citing works
A review on solar energy use in industries
Mekhilef, S., Saidur, R., & Safari, A. (2011) · Renewable and Sustainable Energy Reviews · doi:10.1016/j.rser.2010.12.018 · Cited by 1,102 · see citing works
Lessons Learned from the Maroochy Water Breach
Slay, J., & Miller, M. (2007) · Critical Infrastructure Protection · doi:10.1007/978-0-387-75462-8_6 · Cited by 721 · see citing works
Accurate modeling of modbus/TCP for intrusion detection in SCADA systems
Goldenberg, N., & Wool, A. (2013) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2013.05.001 · Cited by 323 · see citing works
Attack taxonomies for the Modbus protocols
Huitsing, P., Chandia, R., Papa, M., & Shenoi, S. (2008) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2008.08.003 · Cited by 249 · see citing works
Semisupervised One-Class Support Vector Machines for Classification of Remote Sensing Data
Muñoz-Marı́, J., Bovolo, F., Gómez‐Chova, L., Bruzzone, L., & Camps‐Valls, G. (2010) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2010.2045764 · Cited by 248 · see citing works
Modbus/DNP3 State-Based Intrusion Detection System
Fovino, I. N., Carcano, A., Murel, T. D. L., Trombetta, A., & Masera, M. (2010) · International Conference on Advanced Information Networking and Applications (AINA) · doi:10.1109/aina.2010.86 · Cited by 153 · see citing works
Industrial Control System Network Intrusion Detection by Telemetry Analysis
Ponomarev, S., & Atkison, T. (2015) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2015.2443793 · Cited by 147 · see citing works
Future trends in process automation
Jämsä‐Jounela, S. (2007) · Annual Reviews in Control · doi:10.1016/j.arcontrol.2007.08.003 · Cited by 118 · see citing works
An unsupervised anomaly-based detection approach for integrity attacks on SCADA systems
Almalawi, A., Yu, X., Tari, Z., Fahad, A., & Khalil, I. (2014) · Computers & Security · doi:10.1016/j.cose.2014.07.005 · Cited by 113 · see citing works
Control variable classification, modeling and anomaly detection in Modbus/TCP SCADA systems
Erez, N., & Wool, A. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.05.001 · Cited by 87 · see citing works
Authentication and authorization mechanisms for substation automation in smart grid network
Vaidya, B., Makrakis, D., & Mouftah, H. T. (2013) · IEEE Network · doi:10.1109/mnet.2013.6423185 · Cited by 43 · see citing works
Practical Data Communications for Instrumentation and Control
(2003) · Elsevier eBooks · doi:10.1016/b978-0-7506-5797-6.x5000-x · Cited by 31 · see citing works
Modbus/TCP Communication Anomaly Detection Based on PSO-SVM
Shang, W. L., Zhang, S. S., & Wan, M. (2014) · Applied Mechanics and Materials · doi:10.4028/www.scientific.net/amm.490-491.1745 · Cited by 15 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics
Pliatsios, D., Sarigiannidis, P., Lagkas, T., & Sarigiannidis, A. G. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2987688 · Cited by 320 · see citing works
“Deng et al. [112] used Support Vector Machine (SVM) [113] to identify abnormal traffic.”
MethodSverko, M., Grbac, T. G., & Mikuc, M. (2022) · IEEE Access · doi:10.1109/access.2022.3211288 · Cited by 71 · see citing works
“…Inference Attacks [180], related system vulnerabilities as well as exploring new ways to protect critical infrastructures such as Blockchain [181] and implementation of AI algorithms for intrusion detection systems (IDS) such as Support vector machine (SVM) access to Modbus TCP protocol [182].”
Background
- Authors
- Deng, L., Peng, Y., Liu, C., Xin, X., & Xie, Y.
- Affiliations
- University of Electronic Science and Technology of China (CN)
- Venue
- 2016 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
- Publisher
- IEEE
- Published
- 2016-12
- Volume
- 12
- Pages
- 380-383
- OpenAlex
- W2611371465
- Cited by
- 14
- References
- 14
- Citations by year
- 2025: 1 · 2024: 1 · 2022: 1 · 2021: 3 · 2020: 3 · 2019: 3 · 2018: 1 · 2017: 1
- FWCI
- 1.42
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
- Keywords
- intrusion detection, Modbus TCP, support vector machine, industrial control systems, network traffic anomaly detection, data preprocessing, industrial network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
